#!/usr/bin/env bash
# Pre-commit hook for the secrets repo.
# Rejects staged plaintext secret files (.env, .dev.vars, gradle.properties)
# without a .age extension.
# This is a safety net, not a security boundary (--no-verify bypasses it).

BLOCKED=$(git diff --cached --name-only | grep -E '(\.env|\.dev\.vars|gradle\.properties)' | grep -v '\.age$' || true)
if [ -n "$BLOCKED" ]; then
  echo "ERROR: Plaintext secret files staged for commit:"
  echo "$BLOCKED"
  echo "Only .age (encrypted) files should be committed."
  exit 1
fi